Loading story…
BitSight TRACE reported that off-brand H96 Android TV streaming boxes were used in a large ad-fraud and residential-proxy operation linked to Zhejiang Fengwo IoT Technology Co., Ltd., also known as Fengwo Group. Researcher Pedro Falé gained visibility into the activity by registering an expired domain previously used by the devices for telemetry, exposing tens of thousands of boxes that spoofed themselves as mobile phones from brands including Samsung, Vivo, Huawei, and Xiaomi. The devices allegedly ran two Fengwo-linked apps that coordinated fake ad clicks against AI-generated websites built to serve ads only to the spoofed mobile identities.
BitSight estimated that about 38,000 devices were contacting one observed Fengwo domain and that the ad-fraud component alone could produce nearly $50,000 per day, not including revenue from proxy services. The report also described the broader Fuyao Enterprise as an Android TV botnet supporting ad fraud at scale, with references to more than 120,000 AI digital humans used in the scheme. Researchers said the boxes switched roles depending on use, acting as residential proxies while the TV was on and performing ad-fraud tasks while it was off, underscoring the privacy, botnet, and supply-chain risks posed by insecure generic streaming devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The FBI issued a Public Service Announcement warning that compromised home-network IoT devices are being used in the BADBOX 2.0 botnet for criminal activity, including residential proxy services. The PSA said the botnet spans millions of infected devices such as TV streaming boxes, projectors, infotainment systems, and digital picture frames, and provided indicators of compromise and mitigation guidance.
A BitSight TRACE report described the 'Fuyao Enterprise' as a hidden Android TV botnet used for large-scale ad fraud. The referenced reporting said the operation used more than 120,000 AI digital humans to support the scheme.
Bitsight TRACE attributed the ad fraud and residential proxy ecosystem involving generic H96 Android TV boxes to Zhejiang Fengwo IoT Technology Co., Ltd., also known as Fengwo Group. The report said apps on the devices coordinated fake ad clicks against AI-generated websites and that the boxes alternated between proxy use and ad fraud activity.
Bitsight TRACE researcher Pedro Falé gained visibility into the operation by registering an expired domain previously used by the devices for telemetry. This exposed tens of thousands of H96 Android TV boxes spoofing mobile phone identities and communicating with the infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcemalware.news
Open sourcekrebsonsecurity.com
Open sourcemalware.news
Open sourcebitsight.com
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Lotus Labs reported a sprawling malicious residential proxy ecosystem built from compromised IoT and SOHO routers, Android devices, and Android TV boxes, tracking nearly **20 million distinct IPs per day** across **30+ botnet clusters**. The research identified major services and botnets including **IPIDEA, Jaguar, Kookeey, NetNut/Popa, G3Proxy, NSOCKS/Ngioweb, and ASOCKS/Nexusnet**, and said many operators both maintain their own botnets and resell access to other infected devices. Lumen said more than 20 of the clusters regularly exceed 100,000 daily victims, with roughly half of the tracked malicious proxy botnets operated by Chinese actors and many services excluding mainland China from their proxy pools. Separate analysis of the low-cost Android-based **Magcubic HY300 Pro+** projector showed how consumer hardware can feed that ecosystem. Investigators found preinstalled firmware components, including **`com.hotack.silentsdk`** and **`com.hotack.writesn`**, generating suspicious DNS requests such as **`usmyip.kkoip.com`** and appearing designed to register the owner’s IP address for possible enrollment into a residential proxy network without consent. Researchers warned the issue may extend to other inexpensive Android projectors tied to **Hotack, Huyukang, and Nonete**, reinforcing concerns that cheap, poorly vetted smart devices are being used as covert infrastructure for proxy botnets and related criminal activity, including card fraud operations and DDoS abuse.
Jul 30, 2026
The Kimwolf botnet has rapidly infected over 1.8 million Android-based devices worldwide, with security researchers warning that the true number may exceed 2 million. The malware primarily targets Android TV boxes, digital photo frames, and other IoT devices, many of which are distributed through major online retailers and often ship with weak security controls or pre-installed malicious software. Kimwolf leverages advanced techniques such as DNS-over-TLS, blockchain-based command and control via Ethereum Name Service (ENS), and residential proxy networks to evade detection and takedown efforts. The botnet enables attackers to launch high-volume DDoS attacks, monetize proxy bandwidth, and conduct lateral movement within local networks, posing a significant threat to both enterprise and consumer environments. Security experts have identified that two-thirds of Kimwolf infections are Android TV boxes lacking basic authentication, making them especially vulnerable. The operators behind Kimwolf, previously linked to the Aisuru botnet, are known for their technical sophistication and rapid adaptation to takedown attempts. Their monetization strategies include ad fraud, DDoS-for-hire services, and the resale of residential proxy bandwidth. The malware often spreads through bundled mobile apps and games, exploiting the global supply chain of low-cost Android devices. Organizations and individuals are urged to identify, isolate, and remediate infected devices to prevent further exploitation and participation in criminal infrastructure.
Jun 29, 2026
Finnish authorities warned that some Android smart devices sold to consumers, particularly televisions, TV boxes, and other home-networked endpoints, have been found with **BadBox 2.0** malware already present before purchase. The malware has been linked especially to low-cost products from lesser-known manufacturers and can also spread through malicious apps and suspicious websites. Officials said the backdoor may be inserted during the production chain, turning affected devices into covert criminal infrastructure while they continue to appear to function normally. BadBox 2.0 allows attackers to remotely load additional modules, collect data, and abuse infected devices for operations including botnet activity and denial-of-service attacks. The malware is considered especially hard to detect and effectively impossible for users to remove because the backdoor resides in firmware that cannot be rewritten without manufacturer support. Estonia's Information System Authority reported more than **7,000** infected devices in the country, underscoring the broader supply-chain security problem. Finland's Cyber Security Centre urged consumers to disconnect suspected devices immediately, install official vendor updates if available, and stop using and dispose of devices if the manufacturer does not provide a fix.
Jun 29, 2026